Web Application Threat Model

[kabuks]

http://msdn.microsoft.com/en-us/library/ms978534.aspx

[mahmud]

Threat modeling is a pain in the ass, doubly so if you're using an automated tool.

Simple, platform and software-specific checklists might be better. Here is a generic one as well.

http://www.sans.org/reading_room/whitepapers/securecode/a_se...

[showerst → mahmud]

Please post a [PDF] warning on pdf links.

[jacquesm → mahmud]

You should post that one separately.

[_zhqs]

I want to vomit when I read the word "stakeholders".